Define a threshold for each Sightings Search Source for which you want to
automatically create security incidents when the defined threshold is
exceeded.

When the sighting count of any observable searched in your environment
exceeds the threshold, a security incident is created and all the observables in
the search are added to that security incident. If a security incident already
exists with the same list of observables, the new incident is made a child
incident.